Google Security Operations
Configure Google Security Operations (Chronicle) SIEM integration with RAD Security for unified threat intelligence.
This guide walks you through enabling the required API, creating a least-privilege custom role, and gathering the information required to connect your Google Security Operations instance as a SIEM with RAD Security.
Google Security Operations (formerly Chronicle) provides cloud-native threat detection, investigation, and response at scale, with deep integration into the Google Cloud ecosystem.
Prerequisites
Before you begin, ensure you have:
- A Google Security Operations instance provisioned in a Google Cloud project
- Access to the Google Cloud Console with permissions to enable APIs, create custom IAM roles, and create service accounts
- Access to a RAD Security workspace with integration permissions
Chronicle API Required: The Chronicle API must be enabled on your Google Cloud project before creating the custom role. Without it, the IAM permissions used in this guide will not appear in the role editor.
Understanding Integration Components
The Google Security Operations integration uses a Google Cloud service account authenticated with a JSON key:
Step 1: Enable the Chronicle API
Sign in to Google Cloud Console
Sign in to the Google Cloud Console with an account that has permission to enable APIs on your project.
Open the API Library
Navigate to APIs & Services → Library.
Find the Chronicle API
Search for Chronicle API in the library.
Enable the API
Click Enable. Wait for the API to finish enabling before continuing.
Step 2: Gather your Security Operations values
Note your Project ID
Open the project picker at the top left of the Google Cloud Console. Filter or find your project in the list and copy the ID value to a safe location.
The Project ID is distinct from the project name and project number. Make sure you copy the ID.
Open Google SecOps
From the console search bar, navigate to Google SecOps.
Open Instance Details
On the Overview page, expand the Instance Details section.
Copy Customer ID and Region
Record the following values to a safe location:
- Customer ID
- Region (typically
usoreu)
Step 3: Create a Limited Permissions Role
You can skip this step and use the built-in Chronicle API Admin role instead, but that grants far more access than RAD Security requires.
Open the IAM Roles editor
Follow the Google documentation to create a custom role in the IAM application.
Configure role metadata
Provide the following values:
| Field | Value |
|---|---|
| Title | A descriptive title (e.g., "RAD Security SecOps Reader") |
| Description | A short description of the role's purpose |
| ID | A unique role ID |
| Role launch stage | General Availability |
Add the required permissions
Locate and add the following permissions:
| Permission | Required |
|---|---|
chronicle.events.import | Only if using event ingestion |
chronicle.events.udmSearch | Yes |
chronicle.logTypes.list | Yes |
chronicle.legacies.legacySearchDetections | Yes |
chronicle.legacies.legacyGetDetection | Yes |
This list may expand as RAD Security adds features to the Google Security Operations connector.
Create the role
Click Create to save the custom role.
Step 4: Create a Service Account
Create a new service account
Follow the Google documentation to create a new service account.
Assign the role
When prompted to assign a role, select either:
- The custom role created in Step 3 (recommended), or
- The built-in Chronicle API Admin role
There is no need to assign additional users or admins to the service account unless desired.
Create a service account key
Follow the Google documentation to create a service account key. This downloads a JSON file containing the values needed to authenticate with Google.
Extract the credential values
From your downloaded key file, record the following values to a safe location:
- Client ID (
client_id) - Client Email (
client_email) - Private Key (
private_key)
Store the key file securely. Anyone with access to this file can authenticate as the service account. Treat it like a password and store it in a secrets vault.
Step 5: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Google Security Operations integration with the following parameters:
| Parameter | Required | Description | Example |
|---|---|---|---|
| Client ID | Yes | The client_id value from your service account key file (Step 4) | 123456789012345678901 |
| Client Secret | Yes | The private_key value from your service account key file (Step 4) | `-----BEGIN PRIVATE KEY----- |
| ... | |||
| -----END PRIVATE KEY----- | |||
| ` | |||
| Client Email | Yes | The client_email value from your service account key file (Step 4) | rad-security@my-project.iam.gserviceaccount.com |
| Customer ID | Yes | The Customer ID gathered in Step 2 | 01234567-89ab-cdef-0123-456789abcdef |
| Project ID | Yes | The GCP Project ID gathered in Step 2 | my-secops-project |
| Region | No | The Region gathered in Step 2 | us or eu |
| Base URL | No | Leave blank in most cases — RAD Security constructs the region-specific API URL automatically | https://us-chronicle.googleapis.com |
| Token URL | No | Leave blank to use the default Google OAuth 2.0 token endpoint | https://oauth2.googleapis.com/token |
About the Client Secret field: For Google service accounts, the Client Secret value is the full PEM-encoded private_key string from your downloaded key file — not a typical OAuth client secret. Include the -----BEGIN PRIVATE KEY----- / -----END PRIVATE KEY----- delimiters and embedded newlines exactly as they appear in the file.
Custom Base URL: Only set the Base URL field if you are targeting a non-standard instance of the Google Cloud Platform. If supplying a custom value, provide the root URL without any paths — for example https://us-chronicle.googleapis.com.
Verify Integration
After completing the setup, verify your integration is working:
Verify Query Capability
- Run a test query from RAD Security
- Verify Google Security Operations data appears correctly
- Check that results are properly formatted
Verify Data Ingestion
If you enabled event ingestion (chronicle.events.import):
- Trigger a test event in RAD Security
- Search for the event in Google Security Operations
- Verify the event appears with correct UDM formatting
Your Google Security Operations integration is now configured! RAD Security can query and forward events to your Security Operations instance based on your configuration.
What Data is Synced
Use Cases
Unified Threat Intelligence Correlate Google Security Operations telemetry with RAD Security's runtime insights for comprehensive threat detection.
Cross-Platform Detection Detect threats that span Google Cloud, endpoints, and containerized infrastructure using unified data sources.
Enhanced Investigation Pivot from RAD Security runtime context into Google Security Operations' investigation tools.
Centralized SIEM Use Google Security Operations as a central SIEM for all security events including container and cloud workloads.
Troubleshooting
Security Best Practices
Use a Custom Role Prefer the least-privilege custom role over the built-in Chronicle API Admin role.
Rotate Service Account Keys Periodically rotate service account keys as part of normal security hygiene.
Secure Credential Storage Store the JSON key file in a secrets vault. Never commit it to source control.
Dedicated Service Account Use a service account dedicated to RAD Security rather than sharing one across integrations.
Monitor API Usage Review service account activity in Google Cloud audit logs to detect anomalous behavior.
Audit Access Periodically review service accounts and remove any that are no longer in use.
Additional Resources
Google Security Operations Onboarding
Official Google documentation for provisioning a Security Operations instance
Create a Custom IAM Role
Google documentation for creating custom IAM roles
Create a Service Account
Google documentation for creating service accounts
Create a Service Account Key
Google documentation for generating service account keys